Rumi Privacy Policy

Effective October 14, 2026

Rumi helps stores and their customers with financing, payments, and other financial tasks through an AI agent. This policy explains what information we collect, how we use and share it, and your choices. It applies to Rumi on WhatsApp and other messaging services, on our websites, and in our apps.

Who is responsible. Grupo Rumi LLC, a Delaware limited liability company (“we” or “us”), is responsible for the personal information it uses to operate Rumi. Our address is 570 Pacific Avenue, San Francisco, California 94133, USA. Contact our privacy team at privacy@rumi.shop or +1-RUMI-800162 (+1-786-480-0162). In Mexico, you can reach us at Gutenberg 60, Colonia Verónica Anzures, Alcaldía Miguel Hidalgo, C.P. 11300, Ciudad de México.

Information we collect

Stores: legal name, tax identification number, tax postal code, contact details, representatives’ names and contact details. From connected accounts, we may access customer names, financed purchases, loan amounts and terms, payment records, application statuses, sales, payouts, and fees, including records predating the Store’s use of Rumi or concerning customers who have never used Rumi.

Sellers: your name and WhatsApp number, which your Store gives us, and the applications and sales you help with.

Shoppers: your name and contact details; what you’re buying and where; your official ID image and the information on it, such as identification numbers, date of birth, address, photo, and signature; occupation and income; requested financing amounts and terms; and offers, approvals, and declines. If you use the relevant features, we also receive information about your loans and payments. We receive this information from you, a Store helping you, or the lenders involved.

Connected accounts: if you’re a Store or Shopper and connect a lender, bank, or other financial account, we receive login details or connection credentials and account information, such as statements, balances, transactions, and payment history.

Everyone: messages, photos, and voice notes you send Rumi; basic profile information from the messaging service; records of notices, permissions, and instructions; and technical information from our websites and apps, such as device, browser, IP address, and pages viewed.

Your consent. We obtain any consent required to use and share your information as described in this policy. A Store helping you must have your permission to share your information with us.

Information from Stores and lenders. If a Store or lender shares information it collected for its own purposes, we provide this policy at first contact and before using it for a new purpose requiring notice or consent. Stores are responsible for required notices and permissions for sharing customer records with us and the uses described in this policy.

How we use your information

We use information to:

• Set up and manage accounts, follow your instructions, and help with applications, offers, purchases, loans, payments, budgets, cash flow, and other financial tasks.
• Communicate with you and coordinate transactions among Shoppers, Stores, Sellers, and lenders.
• Provide, secure, develop, and improve our and our affiliates’ products and services.
• Help assess eligibility for financial products and services you request.
• Verify identity, prevent fraud, provide support, and meet our legal obligations.
• Send updates and offers about Rumi, our affiliates, and partners, according to your marketing choices.

We use AI to help carry out these purposes, including personalizing and comparing options. Lenders make credit decisions.

Google Drive and Gmail connections

Access and purpose. Connecting Google is optional. Rumi receives your Google account identifier, email address, granted permissions, and encrypted authorization tokens, not your Google password. If you connect Drive, you authorize read-only access to all files your Google account can access, including shared files and shared drives. If you connect Gmail, you authorize read-only access to messages and attachments across your mailbox. Rumi can search and read relevant content; these permissions do not let it edit or delete files or send, change, or delete mail.

Background access and storage. Rumi periodically checks for changes after connection. It maintains a stored Drive file and folder map, including names, identifiers, links, folder structure, and modification details, so it can find documents later. It also keeps synchronization records and may record file changes and email details, such as sender and subject, in your conversation. Retrieved content, summaries, and results may remain in conversation records.

Personal or Store. You choose the owner before connecting. Personal access stays within your Rumi account and is not made available to your Store team by connecting. A Store connection and the information read through it are available to people authorized to manage that Store in Rumi. Choose Store only if you have permission to make that information available to its authorized users.

AI and sharing. Rumi and its AI service providers process relevant content to carry out the task you authorize and identify useful store productivity updates. Your messaging platform also processes responses sent through it. We use and share Google data only to provide these features with your consent, for security, to comply with law, or in a business transfer with your prior explicit consent.

Use limits. These limits also cover summaries and other information derived from Google data and take precedence over broader uses described elsewhere in this policy. We do not use Google data for loan applications, creditworthiness, lending, underwriting, advertising, or training general AI models. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

Disconnect and deletion. Ask Rumi to disconnect the named account and Personal or Store owner, then confirm the disconnect button. This stops new reads and removes Rumi's stored access credentials for that owner. It does not automatically delete retained account details, the file map, retrieved content, or conversation records. Removing Rumi from your Google account connections also withdraws Google's authorization. To request deletion of Google data and derived records retained by Rumi, email privacy@rumi.shop with the Google account, the Personal or Store connection, and your request. We verify your identity and any Store authority and handle the request under the rights and retention provisions below.

Who we share it with

We share information about Shoppers, Stores, and Sellers only as described here.

We don’t sell your personal information or a Store’s private business records. We may use public business information, such as a Store’s name, address, and product categories, in directories, recommendations, and other services.

• Stores and Sellers. We share Shoppers’ names, purchase details, application status, and offers with the Stores and Sellers helping with their purchase or financing, including Stores they choose or that start a transaction with them. A Seller may also see information a Shopper provides while asking for help. Stores are separately responsible for information they use for their own sales or customer relationships.
• Store accounts. We share a Store’s account activity and business records, including its Sellers’ activity, with its authorized users as needed to carry out its instructions.
• Lenders. We share a Store’s account information and instructions with its lenders and send Shoppers’ application information, including ID images, income, purchase details, and relevant account records, to their selected lenders. Each lender is responsible for its own data processing and credit decisions under its terms and privacy policy. Some lenders may be affiliated with us.
• Affiliates. Companies in our group may use information for the purposes described above.
• Service providers. We use outside providers to process information on our behalf.
• Messaging platforms. Messaging platforms and their affiliated companies, such as WhatsApp and Meta, also process some information for their own purposes under their terms and privacy policies.
• Business transfers. We may share information confidentially in connection with a proposed or completed sale or reorganization of all or part of our business. A successor may receive, use, and share the information on the same terms as we do under this policy and applicable law.
• Legal reasons. When the law requires it, to respond to authorities, or to protect Rumi, our users, or the public.

Your consent to sharing. When consent is required, we ask you to accept or refuse a disclosure before it happens. We may share information without consent where the law permits.

Anonymized information. We may use and share information that neither we nor a recipient can reasonably link to an individual, including insights about financing demand and pricing trends. Information that can still identify someone remains subject to this policy and required permissions.

Where we process information. Your information may be stored or processed in the United States, Mexico, and other countries, with the protections required by applicable law.

Your rights and choices

Access, correct, delete, or object. You or your representative can ask to access, correct, or delete your personal information, or object to its use. Email privacy@rumi.shop or message Rumi with your name, contact details, request, and information verifying your identity and any representative’s authority. We respond and provide requested information electronically, within the deadlines required by law. In Mexico, we respond within 20 business days and, if granted, act within the following 15 business days. If we need more information or a legally permitted extension, we’ll explain what is needed and the applicable timing.

Withdraw consent or limit use. Message Rumi or email privacy@rumi.shop to withdraw consent or request limits on how we use your information. Withdrawal applies going forward. You can decline promotions without losing access to Rumi. If information is necessary for a requested task, withdrawing permission may prevent us from completing it.

Stop messages or close your account. Reply “STOP” to an offer to stop marketing messages. You can also ask us to stop all WhatsApp messages, close your account, or delete your information. These are separate choices. If you stop WhatsApp messages, we may use SMS for necessary service and legal notices. We handle deletion requests under the retention rules below, and only an authorized Store representative can close a Store account.

Complaints. You can contact us about how we handle your information or complain to the relevant data protection authority.

Security and retention

We use administrative, technical, and physical safeguards appropriate to the information and the risks, including encryption and limits on access. We protect your login details and use them to access the accounts you connect, as described in this policy. We’ll notify affected users of security breaches as required by law.

We retain personal information for the purposes described here and to meet legal obligations, and delete or anonymize it when no longer needed. If we retain records solely for legal obligations or potential liabilities, we restrict their use to those purposes and delete them when the applicable retention periods end.

Websites, apps, and cookies

Our websites and apps use cookies and similar tools to work properly and understand how they are used. You can turn cookies off in your browser settings, although some features may then stop working.

Changes to this policy

We’ll post changes at rumi.shop/privacy and provide any notice or obtain any consent required by law.